any part of the file

all of the file

the starting cluster of the file

the directory entry for the file

The .case file writes a CRC value for the case information and verifies it when the case is opened.

EnCase does not verify the case information and case information can be changed by the user as it becomes necessary.

EnCase writes a CRC value of the case information and verifies the CRC value when the evidence is added to a case.

EnCase writes an MD5 hash value for the entire evidence file, which includes the case information, and verifies the MD5 hash when the evidence is added to a case.

1

2

3

4

The data from the beginning of the starting cluster to the length of the file.

The data taken from the starting cluster to the end of the last cluster that is occupied by the file.

A file including any RAM and disk slack.

A file including only RAM slack.

Storing information that is specific to a particular case.

Storing information that will be available to EnCase each time it is opened, regardless of the active case(s).

Storing pointers to acquired evidence.

Storing the results of a signature analysis.

This is the folder that will automatically store an evidence file when the acquisition is made in DOS.

This is the folder that temporarily stores all bookmark and search results.

This is the folder used to hold copies of files that are sent to external viewers.

This is the folder that will be automatically selected when the copy/unerase feature is used.

FAT

File header

Operating system

Directory entry